---
title: "Free Email Header Analyzer | DMARC Report"
description: "Paste raw email headers and instantly see the full delivery path, per-hop time delays, and SPF, DKIM, and DMARC results. Parsed in your browser, nothing uploaded."
image: "https://dmarcreport.com/images/og-default.png"
canonical: "https://dmarcreport.com/tools/email-header-analyzer/"
---

## What does each hop tell you?

A `Received:` line is stamped onto the message every time a mail server takes custody of it. The line records who handed the message off, who took it, the protocol used, the server’s identifier, and a timestamp. Read top to bottom in raw form, you are reading from final hop back to origin. The analyzer flips that around so the path reads naturally, oldest to newest.

The delay between any two adjacent hops is the most useful number on the page. Sub-second delays are normal. Multi-second or multi-minute delays usually point to a queueing or greylisting issue at the receiving end. Multi-hour delays nearly always mean a queue backed up because of a downstream problem (often spam-filter rate-limiting or DNS failure).

## How to read the results

### Delivery path

Each numbered hop is one server taking custody of the message. The +time on each hop is the time elapsed since the previous hop. Total transit at the top is origin to final hop.

### Authentication results

SPF, DKIM, DMARC, and any other methods the recipient mail server checked. A pass on all three is the goal. A fail on DKIM with SPF passing usually means the message was modified in transit (forwarder rewriting headers).

### Message identity

From, Return-Path, and DKIM signing domain (d=). When these disagree, you are likely looking at a third-party sender on behalf of someone else, which is fine if SPF/DKIM align, suspicious if they do not.

### ARC chain

If the message went through a forwarder or mailing list, ARC headers preserve the original authentication results. The number of ARC instances tells you how many forwarders the message passed through.

## One failed message is a clue. Every failed message is a pattern.

The header analyzer shows you why a single message failed. DMARC Report processes the aggregate reports from every mailbox provider, classifies each sender by vendor, and shows you exactly which sources are failing SPF or DKIM across your whole domain - so you fix the cause, not the symptom.

[Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [View Plans & Pricing](/pricing/) 

## Frequently asked questions

What is an email header? 

Email headers are the metadata attached to every message: the From, To, Subject, Date, and Message-ID lines you can already see, plus the Received: chain that records every server the message touched on its way to your inbox, the SPF / DKIM / DMARC results, and the DKIM signatures. Headers travel with the message and are how you trace a delivery problem back to its cause.

How do I get the raw headers from my email client? 

Gmail: open the message, click the three-dot menu, choose Show original. Outlook on the web: open the message, three-dot menu, View, View message source. Apple Mail: View menu, Message, All Headers. Outlook desktop: open the message, File, Properties, Internet headers. Copy the entire block and paste it into the analyzer.

How do I read the delivery path? 

Each Received: header is added by a mail server as the message moves through it. The most recent server is at the top of the raw headers. The analyzer reverses them so the origin (where the message was first composed or relayed) appears first and the final delivering server appears last. The +time on each hop is how long the message sat between that server and the previous one.

How does the header analyzer relate to my DMARC reports? 

The header analyzer reads the SPF, DKIM, and DMARC results the recipient stamped onto one specific message - it is per-message forensics. Your DMARC aggregate reports are the population view: every source sending as your domain, with pass/fail counts over time. Use the analyzer to diagnose why one message failed, then use DMARC Report to confirm whether that failure is isolated or systemic across all your senders.

A hop shows a negative delay. What does that mean? 

Negative or zero delays usually indicate clock skew between mail servers. It does not mean anything was tampered with. Some servers run slightly fast or slow against UTC and the timestamps on adjacent Received: lines can disagree by a few seconds.

Why are SPF, DKIM, and DMARC empty? 

The analyzer reads the Authentication-Results header that the recipient mail server adds. If you pasted headers from a server that is upstream of the final delivery (e.g., a forwarder or relay), or from a sending server, that header will not be present. Always paste the headers as they arrived in the destination mailbox.

Are the headers I paste sent anywhere? 

No. Parsing happens entirely in your browser. Nothing is uploaded, stored, or logged. You can confirm by opening DevTools and watching the Network tab while you paste.

## Stop reading headers by hand

DMARC Report monitors SPF, DKIM, and DMARC across all your domains and shows you exactly which senders are failing - and how to fix them. Setup takes 60 seconds.

[Start Free Trial](https://app.dmarcreport.com/signup?plan=free)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is an email header?","acceptedAnswer":{"@type":"Answer","text":"Email headers are the metadata attached to every message: the From, To, Subject, Date, and Message-ID lines you can already see, plus the Received: chain that records every server the message touched on its way to your inbox, the SPF / DKIM / DMARC results, and the DKIM signatures. Headers travel with the message and are how you trace a delivery problem back to its cause."}},{"@type":"Question","name":"How do I get the raw headers from my email client?","acceptedAnswer":{"@type":"Answer","text":"Gmail: open the message, click the three-dot menu, choose Show original. Outlook on the web: open the message, three-dot menu, View, View message source. Apple Mail: View menu, Message, All Headers. Outlook desktop: open the message, File, Properties, Internet headers. Copy the entire block and paste it into the analyzer."}},{"@type":"Question","name":"How do I read the delivery path?","acceptedAnswer":{"@type":"Answer","text":"Each Received: header is added by a mail server as the message moves through it. The most recent server is at the top of the raw headers. The analyzer reverses them so the origin (where the message was first composed or relayed) appears first and the final delivering server appears last. The +time on each hop is how long the message sat between that server and the previous one."}},{"@type":"Question","name":"How does the header analyzer relate to my DMARC reports?","acceptedAnswer":{"@type":"Answer","text":"The header analyzer reads the SPF, DKIM, and DMARC results the recipient stamped onto one specific message - it is per-message forensics. Your DMARC aggregate reports are the population view: every source sending as your domain, with pass/fail counts over time. Use the analyzer to diagnose why one message failed, then use DMARC Report to confirm whether that failure is isolated or systemic across all your senders."}},{"@type":"Question","name":"A hop shows a negative delay. What does that mean?","acceptedAnswer":{"@type":"Answer","text":"Negative or zero delays usually indicate clock skew between mail servers. It does not mean anything was tampered with. Some servers run slightly fast or slow against UTC and the timestamps on adjacent Received: lines can disagree by a few seconds."}},{"@type":"Question","name":"Why are SPF, DKIM, and DMARC empty?","acceptedAnswer":{"@type":"Answer","text":"The analyzer reads the Authentication-Results header that the recipient mail server adds. If you pasted headers from a server that is upstream of the final delivery (e.g., a forwarder or relay), or from a sending server, that header will not be present. Always paste the headers as they arrived in the destination mailbox."}},{"@type":"Question","name":"Are the headers I paste sent anywhere?","acceptedAnswer":{"@type":"Answer","text":"No. Parsing happens entirely in your browser. Nothing is uploaded, stored, or logged. You can confirm by opening DevTools and watching the Network tab while you paste."}}]},{"@context":"https://schema.org","@type":"WebPage","name":"Free Email Header Analyzer | DMARC Report","url":"https://dmarcreport.com/tools/email-header-analyzer/","description":"The free Email Header Analyzer from DMARC Report parses raw email headers and instantly shows the full delivery path with per-hop time delays, plus SPF, DKIM, DMARC, and ARC results at a glance. Parsing happens entirely in your browser - nothing is uploaded, stored, or logged - and no signup is required.","speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"SoftwareApplication","name":"Free Email Header Analyzer","applicationCategory":"WebApplication","operatingSystem":"Web","description":"Paste raw email headers and instantly see the full delivery path, per-hop time delays, and SPF, DKIM, and DMARC results. Parsed in your browser, nothing uploaded.","url":"https://dmarcreport.com/tools/email-header-analyzer/","offers":{"@type":"Offer","price":"0","priceCurrency":"USD"},"provider":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1"}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Tools","item":"https://dmarcreport.com/tools/"},{"@type":"ListItem","position":3,"name":"Email Header Analyzer","item":"https://dmarcreport.com/tools/email-header-analyzer/"}]}
```